This all misses the point of my first post. You could have a much safer design available, but if the 'less safe' design is more cost effective, and meets all s

This all misses the point of my first post. You could have a much safer design available, but if the 'less safe' design is more cost effective, and meets all specifications, it would still be the preferred design. This means that the any problem is with the specifications/requirements. The next question is whether the standard of safety which would require choosing the 'failsafe' (or at least failsafer) design would cause statistical murder.